Don't try to override system FIPS mode and use openssl.FIPSCapable

[qmuntal]

As agreed in https://github.com/microsoft/go-lab/blob/main/docs/adr/0012-remove-gofips.md, we shouldn't try to modify the OpenSSL FIPS mode.

Azure Linux 3 doesn't set fips=yes in the default properties, even when running in kernel FIPS mode. They omit it because the default OpenSSL provider, SCOSSL, is already FIPS compliant, and not setting it allows some non-FIPS algorithms to fall back to the built-in provider (which is also enabled by default). This means we can't use openssl.FIPS() (which checks if fips=yes is set) in AZL3. Fortunately we can use openssl.FIPSCapable() instead, which doesn't check if fips=yes is set.

This has the nice benefit of being more compliant when running in FIPS mode on AZL3, as more non-FIPS approved algorithms (like SHA1) will be provided by the built-in OpenSSL providers instead of falling back to Go.

For #1445.

[dagood]

LGTM, in particular the non-symmetry between using openssl.FIPSCapable and openssl.FIPS does make sense here to me with your comments. 👍